CVE-2026-0257: PAN-OS GlobalProtect Authentication Bypass Under Active Exploitation

Summary

CVE-2026-0257 is a medium-severity (CVSS 7.8) authentication bypass vulnerability affecting Palo Alto Networks PAN-OS and Prisma Access GlobalProtect components. The flaw allows attackers to bypass security restrictions and establish unauthorized VPN connections when authentication override cookies and specific certificate configurations are enabled. Palo Alto Networks reported limited exploit attempts, while Rapid7 observed successful exploitation across numerous customers with activity starting May 17, 2026, and a second wave on May 21 by the same threat actor. In the second wave, attackers obtained VPN IP assignments after cookie authentication in two cases, granting internal network access with no observed follow-on activity. Rapid7 has urged urgent patching.